//
//  NSData+RCRSA.m
//  StructToolsDemo
//
//  Created by 杨晓辉 on 2017/8/22.
//  Copyright © 2017年 杨晓辉. All rights reserved.
//

#import "NSData+RCRSA.h"



static  NSString *publicKeyString = @"-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDzr5TafpcAjOsiu2R8ZCGVA9P58Zp156JR1xKILCkVYNbpA1BylDrB0mYZINueogKzXFOnOpYGqRA5ykD43Y2vZZiwZiMVazCqB09qiIK/kQoFqkasan0PDge3mSE2nWh4mJeKyQ3AzSU4qlAeESe7UzheRjybhsHrorwXJhfqowIDAQAB\n-----END PUBLIC KEY-----";


 static  NSString * privateKeyString = @"-----BEGIN PRIVATE KEY-----\nMIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAPOvlNp+lwCM6yK7ZHxkIZUD0/nxmnXnolHXEogsKRVg1ukDUHKUOsHSZhkg256iArNcU6c6lgapEDnKQPjdja9lmLBmIxVrMKoHT2qIgr+RCgWqRqxqfQ8OB7eZITadaHiYl4rJDcDNJTiqUB4RJ7tTOF5GPJuGweuivBcmF+qjAgMBAAECgYBIVfB7w2QTl8EcuD+l5RtK3q4H3b4aDb5TSOKJZYJ0hCCHXqJ8wJ+IdWo1P1myBymCEIAMfgmWxIy6et06gpnRyLALh753ngXEl4fytGohwe0rcuGja+68JkFfnXxa/UtuUrO8vPhahAafsge2sftiptEeUjWaJQWmCKI3KVHWwQJBAPoBRyWnerSItTdCNOTpMYE/iVITf16tWfDL9OVS8wFAdTrCGDW63qTDKPY7aOJP/p0Pxkj3CfYRfjmi8G137tECQQD5h4ML+jslBIKm/NYZIJEI75pfjgX+wVzhrlOgg8AMZi62Gu+NfjXfM+BE1yOlTRv7WljVc+/opfcNdDdIGaczAkEA4Ro/dm77NAyXpl6tg6NYWLjdqxI1MAlEH2V1ZvquJOVl6HcVF2PfzliOzE6n3IYMilzGu7H7vRz5G2pTsy020QJAdYNsI+fkkrpdDWdlLNA5fYvZl8a67A8EPwRqPd3ORAibVwe4aVpW5Jb5t3HaR67Yzrbtvxiqk1YV0zA4GKx8IQJBAJokS3zrZ+kR0x7LIEbtcbD4KD9QLtbEWJc0tPdcT6eRZcckOzMtwehWe5BB7szs3HKrAqYXp4w2EJMF9VlFzck=\n-----END PRIVATE KEY-----";



/**
 公钥证书
 
 @return 公钥证书路径
 */
#define PUB_PATH [[NSBundle mainBundle] pathForResource:@"rsa_cer" ofType:@"der"];

/**
 私钥证书
 
 @return 私钥证书路径
 */
#define PRI_PATH [[NSBundle mainBundle] pathForResource:@"private" ofType:@"p12"];
@implementation NSData (RCRSA)

#pragma mark + 使用 公钥加密、私钥解密
/**
 公钥加密
 
 @param data 需加密数据
 @return 密文
 */


+ (NSData *)publicKeyEncryptRSAWithData:(NSData *)data;
{
    
    SecKeyRef keyRef = [self getPublicSecKeyRef];
    if (!data) {
        NSLog(@"data数据为空");
        return nil;
    }
    if (!keyRef) {
        NSLog(@"获取公钥失败");
    }
    return [self encryptData:data withKeyRef:keyRef isSign:NO];
    
    
}
/**
 私钥解密
 
 @param data 待解密的数据
 @return return value description
 */


+ (NSData *)privateKeyDecryptRSAWithData:(NSData *)data;
{
    if(!data ){
        NSLog(@"解密data为空");
        return nil;
    }
    SecKeyRef keyRef = [self getPrivateSecKeyRef];
    if(!keyRef){
        NSLog(@"获取私钥失败");
    }
    return [self decryptData:data withKeyRef:keyRef];
    
}


#pragma mark ---私钥加密 公钥解密--

+ (NSData *)privateKeyEncryptRSAWithData:(NSData *)data;
{
    SecKeyRef keyRef = [self getPrivateSecKeyRef];
    if (!data) {
        NSLog(@"data数据为空");
        return nil;
    }
    if (!keyRef) {
        NSLog(@"获取私钥失败");
    }
    return [self encryptData:data withKeyRef:keyRef isSign:YES];
}


+ (NSData *)publicKeyDecryptRSAWithData:(NSData *)data;
{
    SecKeyRef keyRef = [self getPublicSecKeyRef];
    if (!data) {
        NSLog(@"data数据为空");
        return nil;
    }
    if (!keyRef) {
        NSLog(@"获取公钥失败");
    }
    return [self decryptData:data withKeyRef:keyRef];
}

#pragma mark ---Public Method--
/**
 获取SecKeyRef
 
 @return SecKeyRef
 */
+ (SecKeyRef)getPublicSecKeyRef
{
    SecKeyRef ref;
    
    //    1 .通过密钥字符串
    //    ref= [self loadPublicKeyFromKeyStr];
    // 2.通过证书
    ref= [self loadPublicKeyFromFile];
    return ref;
}

/**
 通过公钥证书路径加载
 
 @return return value description
 */
+ (SecKeyRef)loadPublicKeyFromFile
{
    NSString * path = PUB_PATH;
    NSData *derData = [[NSData alloc] initWithContentsOfFile:path];
    
    SecCertificateRef myCertificate = SecCertificateCreateWithData(kCFAllocatorDefault, (__bridge CFDataRef)derData);
    SecPolicyRef myPolicy = SecPolicyCreateBasicX509();
    SecTrustRef myTrust;
    OSStatus status = SecTrustCreateWithCertificates(myCertificate,myPolicy,&myTrust);
    SecTrustResultType trustResult;
    if (status == noErr)
    {
        status = SecTrustEvaluate(myTrust, &trustResult);
    }
    SecKeyRef securityKey = SecTrustCopyPublicKey(myTrust);
    CFRelease(myCertificate);
    CFRelease(myPolicy);
    CFRelease(myTrust);
    return securityKey;
}

/**
 通过公钥字符串加载 SecKeyRef
 
 @return return value description
 */
+ (SecKeyRef)loadPublicKeyFromKeyStr
{
    NSString * key = publicKeyString;;
    NSRange spos = [key rangeOfString:@"-----BEGIN PUBLIC KEY-----"];
    NSRange epos = [key rangeOfString:@"-----END PUBLIC KEY-----"];
    if(spos.location != NSNotFound && epos.location != NSNotFound){
        NSUInteger s = spos.location + spos.length;
        NSUInteger e = epos.location;
        NSRange range = NSMakeRange(s, e-s);
        key = [key substringWithRange:range];
    }
    key = [key stringByReplacingOccurrencesOfString:@"\r" withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@"\n" withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@"\t" withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@" "  withString:@""];
    
    
    //    将密钥转成Base64
    NSData * data = [self base64_decode:key];
    data = [self stripPublicKeyHeader:data];
    if(!data){
        return nil;
    }
    //a tag to read/write keychain storage
    NSString *tag = @"RSAUtil_PubKey";
    NSData *d_tag = [NSData dataWithBytes:[tag UTF8String] length:[tag length]];
    
    // Delete any old lingering key with the same tag
    NSMutableDictionary *publicKey = [[NSMutableDictionary alloc] init];
    [publicKey setObject:(__bridge id) kSecClassKey forKey:(__bridge id)kSecClass];
    [publicKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
    [publicKey setObject:d_tag forKey:(__bridge id)kSecAttrApplicationTag];
    SecItemDelete((__bridge CFDictionaryRef)publicKey);
    
    // Add persistent version of the key to system keychain
    [publicKey setObject:data forKey:(__bridge id)kSecValueData];
    [publicKey setObject:(__bridge id) kSecAttrKeyClassPublic forKey:(__bridge id)
     kSecAttrKeyClass];
    [publicKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)
     kSecReturnPersistentRef];
    
    CFTypeRef persistKey = nil;
    OSStatus status = SecItemAdd((__bridge CFDictionaryRef)publicKey, &persistKey);
    if (persistKey != nil){
        CFRelease(persistKey);
    }
    if ((status != noErr) && (status != errSecDuplicateItem)) {
        return nil;
    }
    [publicKey removeObjectForKey:(__bridge id)kSecValueData];
    [publicKey removeObjectForKey:(__bridge id)kSecReturnPersistentRef];
    [publicKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)kSecReturnRef];
    [publicKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
    
    // Now fetch the SecKeyRef version of the key
    SecKeyRef keyRef = nil;
    status = SecItemCopyMatching((__bridge CFDictionaryRef)publicKey, (CFTypeRef *)&keyRef);
    if(status != noErr){
        return nil;
    }
    return keyRef;
    
}

/**
 处理公钥数据
 
 @param d_key d_key description
 @return return value description
 */
+ (NSData *)stripPublicKeyHeader:(NSData *)d_key{
    // Skip ASN.1 public key header
    if (d_key == nil) return(nil);
    
    unsigned long len = [d_key length];
    if (!len) return(nil);
    
    unsigned char *c_key = (unsigned char *)[d_key bytes];
    unsigned int  idx	 = 0;
    
    if (c_key[idx++] != 0x30) return(nil);
    
    if (c_key[idx] > 0x80) idx += c_key[idx] + 0x80 + 1;
    else idx++;
    
    // PKCS #1 rsaEncryption szOID_RSA_RSA
    static unsigned char seqiod[] =
    { 0x30,   0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
        0x01, 0x05, 0x00 };
    if (memcmp(&c_key[idx], seqiod, 15)) return(nil);
    
    idx += 15;
    
    if (c_key[idx++] != 0x03) return(nil);
    
    if (c_key[idx] > 0x80) idx += c_key[idx] + 0x80 + 1;
    else idx++;
    
    if (c_key[idx++] != '\0') return(nil);
    
    // Now make a new NSData from this buffer
    return([NSData dataWithBytes:&c_key[idx] length:len + idx]);
    
}

/* START: Encryption & Decryption with RSA private key */

/**
 用SecKeyRef加密
 
 @param data 待加密数据
 @param keyRef keyRef
 @param isSign isSign description
 @return 加密后的的Data
 */
+ (NSData *)encryptData:(NSData *)data withKeyRef:(SecKeyRef) keyRef isSign:(BOOL)isSign {
    const uint8_t *srcbuf = (const uint8_t *)[data bytes];
    size_t srclen = (size_t)data.length;
    
    size_t block_size = SecKeyGetBlockSize(keyRef) * sizeof(uint8_t);
    void *outbuf = malloc(block_size);
    size_t src_block_size = block_size + 11;
    
    NSMutableData *ret = [[NSMutableData alloc] init];
    for(int idx=0; idx<srclen; idx+=src_block_size){
        //NSLog(@"%d/%d block_size: %d", idx, (int)srclen, (int)block_size);
        size_t data_len = srclen + idx;
        if(data_len > src_block_size){
            data_len = src_block_size;
        }
        
        size_t outlen = block_size;
        OSStatus status = noErr;
        
        if (isSign) {
            status = SecKeyRawSign(keyRef,
                                   kSecPaddingPKCS1,
                                   srcbuf + idx,
                                   data_len,
                                   outbuf,
                                   &outlen
                                   );
        } else {
            status = SecKeyEncrypt(keyRef,
                                   kSecPaddingPKCS1,
                                   srcbuf + idx,
                                   data_len,
                                   outbuf,
                                   &outlen
                                   );
        }
        if (status != 0) {
            NSLog(@"SecKeyEncrypt fail. Error Code: %d", status);
            ret = nil;
            break;
        }else{
            [ret appendBytes:outbuf length:outlen];
        }
    }
    
    free(outbuf);
    CFRelease(keyRef);
    return ret;
}


+ (SecKeyRef)getPrivateSecKeyRef
{
    SecKeyRef ref;
    //    1 .通过密钥字符串
    //        ref= [self loadPrivateKeyFromKeyStr];
    // 2.通过证书
    ref= [self loadPrivateKeyFromFile];
    return ref;
}
+ (SecKeyRef)loadPrivateKeyFromFile
{
    NSString * path = PRI_PATH;
    NSString *password = @"youedata";
    NSData *p12Data = [[NSData alloc] initWithContentsOfFile:path];
    
    
    SecKeyRef privateKeyRef = NULL;
    NSMutableDictionary * options = [[NSMutableDictionary alloc] init];
    [options setObject: password forKey:(__bridge id)kSecImportExportPassphrase];
    CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL);
    OSStatus securityError = SecPKCS12Import((__bridge CFDataRef) p12Data, (__bridge CFDictionaryRef)options, &items);
    if (securityError == noErr && CFArrayGetCount(items) > 0)
    {
        CFDictionaryRef identityDict = CFArrayGetValueAtIndex(items, 0);
        SecIdentityRef identityApp = (SecIdentityRef)CFDictionaryGetValue(identityDict, kSecImportItemIdentity);
        securityError = SecIdentityCopyPrivateKey(identityApp, &privateKeyRef);
        if (securityError != noErr)
        {
            privateKeyRef = NULL;
        }
    }    CFRelease(items);
    //    NSLog(@"privateKeyRef: %@", privateKeyRef);
    return privateKeyRef;
    
}

/**
 加载私钥SecKeyRef
 
 @return return value description
 */
+ (SecKeyRef)loadPrivateKeyFromKeyStr
{
    
    NSString * key = publicKeyString;
    NSRange spos;
    NSRange epos;
    spos = [key rangeOfString:@"-----BEGIN RSA PRIVATE KEY-----"];
    if(spos.length > 0){
        epos = [key rangeOfString:@"-----END RSA PRIVATE KEY-----"];
    }else{
        spos = [key rangeOfString:@"-----BEGIN PRIVATE KEY-----"];
        epos = [key rangeOfString:@"-----END PRIVATE KEY-----"];
    }
    if(spos.location != NSNotFound && epos.location != NSNotFound){
        NSUInteger s = spos.location + spos.length;
        NSUInteger e = epos.location;
        NSRange range = NSMakeRange(s, e-s);
        key = [key substringWithRange:range];
    }
    key = [key stringByReplacingOccurrencesOfString:@"\r" withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@"\n" withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@"\t" withString:@""];
    key = [key stringByReplacingOccurrencesOfString:@" "  withString:@""];
    
    // This will be base64 encoded, decode it.
    
    NSData * data = [self base64_decode:key];
    data = [self stripPrivateKeyHeader:data];
    if(!data){
        return nil;
    }
    
    //a tag to read/write keychain storage
    NSString *tag = @"RSAUtil_PrivKey";
    NSData *d_tag = [NSData dataWithBytes:[tag UTF8String] length:[tag length]];
    
    // Delete any old lingering key with the same tag
    NSMutableDictionary *privateKey = [[NSMutableDictionary alloc] init];
    [privateKey setObject:(__bridge id) kSecClassKey forKey:(__bridge id)kSecClass];
    [privateKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
    [privateKey setObject:d_tag forKey:(__bridge id)kSecAttrApplicationTag];
    SecItemDelete((__bridge CFDictionaryRef)privateKey);
    
    // Add persistent version of the key to system keychain
    [privateKey setObject:data forKey:(__bridge id)kSecValueData];
    [privateKey setObject:(__bridge id) kSecAttrKeyClassPrivate forKey:(__bridge id)
     kSecAttrKeyClass];
    [privateKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)
     kSecReturnPersistentRef];
    
    CFTypeRef persistKey = nil;
    OSStatus status = SecItemAdd((__bridge CFDictionaryRef)privateKey, &persistKey);
    if (persistKey != nil){
        CFRelease(persistKey);
    }
    if ((status != noErr) && (status != errSecDuplicateItem)) {
        return nil;
    }
    
    [privateKey removeObjectForKey:(__bridge id)kSecValueData];
    [privateKey removeObjectForKey:(__bridge id)kSecReturnPersistentRef];
    [privateKey setObject:[NSNumber numberWithBool:YES] forKey:(__bridge id)kSecReturnRef];
    [privateKey setObject:(__bridge id) kSecAttrKeyTypeRSA forKey:(__bridge id)kSecAttrKeyType];
    
    // Now fetch the SecKeyRef version of the key
    SecKeyRef keyRef = nil;
    status = SecItemCopyMatching((__bridge CFDictionaryRef)privateKey, (CFTypeRef *)&keyRef);
    if(status != noErr){
        return nil;
    }
    return keyRef;
    
}

+ (NSData *)stripPrivateKeyHeader:(NSData *)d_key{
    // Skip ASN.1 private key header
    if (d_key == nil) return(nil);
    
    unsigned long len = [d_key length];
    if (!len) return(nil);
    
    unsigned char *c_key = (unsigned char *)[d_key bytes];
    unsigned int  idx    = 22; //magic byte at offset 22
    
    if (0x04 != c_key[idx++]) return nil;
    
    //calculate length of the key
    unsigned int c_len = c_key[idx++];
    int det = c_len & 0x80;
    if (!det) {
        c_len = c_len & 0x7f;
    } else {
        int byteCount = c_len & 0x7f;
        if (byteCount + idx > len) {
            //rsa length field longer than buffer
            return nil;
        }
        unsigned int accum = 0;
        unsigned char *ptr = &c_key[idx];
        idx += byteCount;
        while (byteCount) {
            accum = (accum << 8) + *ptr;
            ptr++;
            byteCount--;
        }
        c_len = accum;
    }
    
    // Now make a new NSData from this buffer
    return [d_key subdataWithRange:NSMakeRange(idx, c_len)];
}

+ (NSData *)decryptData:(NSData *)data withKeyRef:(SecKeyRef) keyRef
{
    const uint8_t *srcbuf = (const uint8_t *)[data bytes];
    size_t srclen = (size_t)data.length;
    
    size_t block_size = SecKeyGetBlockSize(keyRef) * sizeof(uint8_t);
    UInt8 *outbuf = malloc(block_size);
    size_t src_block_size = block_size;
    
    NSMutableData *ret = [[NSMutableData alloc] init];
    for(int idx=0; idx<srclen; idx+=src_block_size){
        //NSLog(@"%d/%d block_size: %d", idx, (int)srclen, (int)block_size);
        size_t data_len = srclen + idx;
        if(data_len > src_block_size){
            data_len = src_block_size;
        }
        
        size_t outlen = block_size;
        OSStatus status = noErr;
        status = SecKeyDecrypt(keyRef,
                               kSecPaddingNone,
                               srcbuf + idx,
                               data_len,
                               outbuf,
                               &outlen
                               );
        if (status != 0) {
            NSLog(@"SecKeyEncrypt fail. Error Code: %d", status);
            ret = nil;
            break;
        }else{
            //the actual decrypted data is in the middle, locate it!
            int idxFirstZero = -1;
            int idxNextZero = (int)outlen;
            for ( int i = 0; i < outlen; i++ ) {
                if ( outbuf[i] == 0 ) {
                    if ( idxFirstZero < 0 ) {
                        idxFirstZero = i;
                    } else {
                        idxNextZero = i;
                        break;
                    }
                }
            }
            
            [ret appendBytes:&outbuf[idxFirstZero+1] length:idxNextZero-idxFirstZero-1];
        }
    }
    
    free(outbuf);
    CFRelease(keyRef);
    return ret;
}



/**
// Base64转成字符串
// 
// @param data Base64
// @return 字符串
// */
+ (NSString *)base64_encode_data:(NSData *)data{
    data = [data base64EncodedDataWithOptions:0];
    NSString *ret = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
    return ret;
}

/**
 字符串转成Base64
 
 @param str 字符串
 @return Base64
 */
+ (NSData *)base64_decode:(NSString *)str{
    NSData *data = [[NSData alloc] initWithBase64EncodedString:str options:NSDataBase64DecodingIgnoreUnknownCharacters];
    return data;
}
@end
